Loading vulnerability…
Unauthenticated stored XSS in LiteSpeed Cache for WordPress
CVE-2023-40000 is an unauthenticated stored cross-site scripting vulnerability in the LiteSpeed Cache plugin for WordPress. Inadequate input sanitization and output escaping allow malicious scripts to be stored through the nameservers and _msg parameters. Attackers can disguise injected payloads as administrator notifications, which execute in an administrator's authenticated browser when a backend page is accessed. Affected-version descriptions conflict: they identify versions through 5.7, versions earlier than 5.7.0.1, or versions through 5.7.0.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits attacker-controlled JavaScript to execute in an administrator's authenticated browser context. Exploitation campaigns use this access to create unauthorized WordPress administrator accounts, inject PHP backdoors into plugin and theme files, and install scripts that track infected websites. These actions can establish persistent administrative access and modify website files or databases.
If you can’t patch tonight, do this now.
Review installed plugins and administrator accounts, inspect WordPress files for unauthorized changes and malicious script references, and investigate unexpected outbound tracking requests. Remove suspicious administrator accounts and malicious modifications as part of compromise cleanup; these measures do not replace updating the vulnerable plugin.
Patch, then assume compromise.
Update LiteSpeed Cache to the latest available version promptly. Because the affected-version descriptions disagree about whether 5.7.0.1 is vulnerable, do not treat that version as an unambiguous remediation target. For potentially compromised installations, investigate unauthorized administrator accounts, inspect plugin and theme files for unexpected modifications or injected scripts, and remove suspicious plugin folders.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.